ClawdDotNet/tests/ClawdDotNet.Core.Tests/Deploymentcenter/TokenProvisionerTests.cs

using System.Net;
using ClawdDotNet.Core.Deploymentcenter;
using Shouldly;

namespace ClawdDotNet.Core.Tests.Deploymentcenter;

public sealed class TokenProvisionerTests
{
    [Fact]
    public async Task Instance_gets_its_own_sub_token()
    {
        var handler = new CapturingHandler(HttpStatusCode.Created,
            """
            {"status":"success","sub_token":"dc_sub_abc","token_id":"tok_s_1",
             "scopes":["watchdog:ping","bugtracker:report"]}
            """);

        using var api = new DeploymentcenterApi("https://dc.example", "master", new HttpClient(handler));

        var token = await new TokenProvisioner(api).ProvisionAsync(
            "ClawdDotNet Produktion", "inst-1", TokenProvisioner.InstanceScopes);

        handler.LastRequest!.RequestUri!.ToString().ShouldBe("https://dc.example/api/tokens/v1/provision");
        handler.LastRequest.Headers.Authorization!.ToString().ShouldBe("Bearer master");
        handler.LastBody!.ShouldContain("\"instance_id\":\"inst-1\"");
        handler.LastBody.ShouldNotBeNull().ShouldContain("watchdog:ping");

        token.Token.ShouldBe("dc_sub_abc");
        token.TokenId.ShouldBe("tok_s_1");
        token.Scopes.ShouldContain("bugtracker:report");
    }

    /// <summary>
    /// A sub-token may not issue further ones. That is the normal case at the second
    /// start and must come out as a clean error, not as a crash.
    /// </summary>
    [Fact]
    public async Task Rejected_provisioning_throws_with_code()
    {
        var handler = new CapturingHandler(HttpStatusCode.Forbidden,
            """{"status":"error","error":{"code":"provision_denied","message":"Kein Master-Token."}}""");

        using var api = new DeploymentcenterApi("https://dc.example", "sub", new HttpClient(handler));

        var ex = await Should.ThrowAsync<DeploymentcenterException>(
            () => new TokenProvisioner(api).ProvisionAsync("x", "inst-1", ["watchdog:ping"]));

        ex.Code.ShouldBe("provision_denied");
    }
    // ─── whoami (SDK 2.7.1) ───

    /// <summary>
    /// The information that matters: which project the token is bound to.
    ///
    /// <para>Since SDK 2.8.1 a watchdog monitor inherits the project of its ping token.
    /// If the binding is missing, the findings land in the phantom project "default" — and a
    /// query for the own project returns zero findings for a running, reporting instance.
    /// Supervision would look like "nothing unusual".</para>
    /// </summary>
    [Fact]
    public async Task Whoami_reads_the_project_binding()
    {
        var handler = new CapturingHandler(HttpStatusCode.OK,
            """
            {"status":"success","token_id":"tok_m_1","name":"DEV-ClawdDotNet","type":"master",
             "owner_type":"dev_agent","is_workbench":true,"project_slug":"clawddotnet",
             "environment":"all","scopes":["*"]}
            """);

        using var api = new DeploymentcenterApi("https://dc.example", "master", new HttpClient(handler));

        var identity = await new TokenProvisioner(api).WhoAmIAsync();

        handler.LastRequest!.RequestUri!.ToString().ShouldBe("https://dc.example/api/tokens/v1/whoami");
        handler.LastRequest.Method.ShouldBe(HttpMethod.Get);

        identity.TokenId.ShouldBe("tok_m_1");
        identity.Name.ShouldBe("DEV-ClawdDotNet");
        identity.Type.ShouldBe("master");
        identity.ProjectSlug.ShouldBe("clawddotnet");
        identity.IsProjectBound.ShouldBeTrue();
        identity.Scopes.ShouldContain("*");
    }

    [Fact]
    public async Task A_token_without_project_is_noticed()
    {
        // project_slug is JSON null, not absent - exactly as it comes from the server.
        var handler = new CapturingHandler(HttpStatusCode.OK,
            """
            {"status":"success","token_id":"tok_s_9","name":"Instanz","type":"sub",
             "project_slug":null,"environment":"production","scopes":["watchdog:ping"]}
            """);

        using var api = new DeploymentcenterApi("https://dc.example", "sub", new HttpClient(handler));

        var identity = await new TokenProvisioner(api).WhoAmIAsync();

        identity.ProjectSlug.ShouldBeNull();
        identity.IsProjectBound.ShouldBeFalse();
    }

    [Fact]
    public async Task An_answer_without_fields_does_not_throw()
    {
        // An older server does not know whoami in this form. The information may
        // be missing; it must not crash.
        var handler = new CapturingHandler(HttpStatusCode.OK, """{"status":"success"}""");

        using var api = new DeploymentcenterApi("https://dc.example", "t", new HttpClient(handler));

        var identity = await new TokenProvisioner(api).WhoAmIAsync();

        identity.TokenId.ShouldBe("");
        identity.Type.ShouldBe("unknown");
        identity.IsProjectBound.ShouldBeFalse();
        identity.Scopes.ShouldBeEmpty();
    }
}